4 ms·

Here is a more informative thread by haveibeenpwned's creator, Troy hunt. https://twitter.com/troyhunt/status/1566565409939427328 https://twitter.com/troyhunt/

Here is a more informative thread by haveibeenpwned's creator, Troy hunt. https://twitter.com/troyhunt/status/1566565409939427328 https://twitter.com/troyhunt/status/1566565409939427328

dang 4y ago
Ok, we'll change to that from https://twitter.com/AggressiveCurl/status/1566161198248509440 https://twitter.com/AggressiveCurl/status/156616119824850944.... Thanks!
- geuis 4y ago
  Just spitballing, but this changing of source url reminds me of an idea I had a while back. In cases like this, where the url is changed from source, the old url should still be linked. Maybe as a sub title, or perhaps there should be a separate "changed" link on posts like this. The changed link could show title or url source changes.
  - pvg 4y ago
    The old url is linked in the url-changed comment. Sometimes there's a pinned topcomment with the old url or the url of a merged thread, if the url change is likely to really confuse.
  - mgdlbp 4y ago
    I'm curious if anyone's been keeping track of title and url changes. HN's small enough that one could easily hold the data. Someone has a page showing recent title changes,[1] but without retention. In that thread is a link to a browser extension that does the same, but I can't tell if its scraping is client-side (probably) or if there's a server. 1 https://news.ycombinator.com/item?id=21617016 https://news.ycombinator.com/item?id=21617016
  - hackernewds 4y ago
    These kinds of edits, without edit history, seem ripe for abuse
    - boomboomsubban 4y ago
      How? And how would edit history realistically stop the admins who could modify the edit history?
      - pvg 4y ago
        One of the few times 'the blockchain' might be a sensible answer, silly as the premise of url or title attack is.
        deleted 4y ago
        [deleted]
        colejohnson66 4y ago
        True, but blockchains only help if you have multiple copies of the chain. With one copy, there’s nothing stoping the owner from rewriting history. It’s why companies saying they’re “investing in blockchains” means nothing; DB replication/redundancy doesn’t stop a malicious owner. So unless we’re all gonna start storing copies of HN’s database(s) on our home computers and phones, a blockchain won’t help stop abuse. Speaking of which, how big would said copies be?
    - phoe-krk 4y ago
      It all boils down to the fact that dang, the admin who does the edits, has a history of doing these changes quite rarely and within reason, plus he always leaves comments when he does so. That approach awarded him some general trust, including mine.
      - geuis 4y ago
        Part of the issue is that it isn't that rare. I guess because I'm reading HN all the time these changes seem fairly frequent, despite overall submission volume. I also have the same trust.
      - Chris2048 4y ago
        > plus he always leaves comments when he does so How do you know this?
NavinF 4y ago
> This is so far pretty inconclusive; some data matches production info, albeit publicly accessible info. Some data is junk, but it could be non-production or test data. It's a bit of a mixed bag so far. The screenshots suggest that someone scraped public data from TikTok and then got hacked. Highly doubt any of this came directly from TikTok.
hackernewds 4y ago
> Example: WeChat (Which is state owned)is within the same database as the TikTok DB (which claims not to give such information to their government). that seems very material, for the US population and Bytedance's verbal commitment to the govt. At this point, it's obvious that data of US citizens (a large chunk underage) has been heavily shared with what is perceived as a rival state
- kweingar 4y ago
  As others have pointed out, this seems to be from a 3rd party service that integrates WeChat with TikTok.
  - deleted 4y ago
    [deleted]
  - duskwuff 4y ago
    It might not necessarily even be a direct integration. WeChat is often used as a primary means of communication within China -- it's comparable to the status of email in the US.
- deleted 4y ago
  [deleted]
- SZJX 4y ago
  Literally “within the same database” is highly improbable as they are direct competitors just like Google and Microsoft are. On the other hand, countless companies will surely try to match user profiles across the apps, which sounds like a common practice everywhere.
  - Diesel555 4y ago
    This is one of the major problems with understanding how China operates. We view China through a Western lens, and just assume we are right - which has very bad policy outcomes. If you read a lot about how the CCP operates (I specify the CCP to differentiate the CCP running the PRC since 1949 from the ROC who fled to Taiwan), it is highly probable that those companies share the same database and have common state ties. If you want data on this assertion research "capitalism with socialist characteristics." If you want the data straight from China read their 14th 5-year plan (I wish the US had these kinds of plans) translated by Georgetown University here [1]. China is very open about what they are doing in published writing. If you want more information read "The World According to China" by Liz Economy. I can suggest about 10 other books too, but that book was published in 2022 and is the most relevant book I read. Unfortunately China's government from a Western lens is such a complex topic I can't simply link to one article about how China runs its economy and "private" organizations to prove my point. This complexity unfortunately leads to people making false assumptions about how China operates without the requisite knowledge - and then deciding how we should make policy decisions towards China. [1] https://cset.georgetown.edu/publication/china-14th-five-year-plan/ https://cset.georgetown.edu/publication/china-14th-five-year...

Here is a more informative thread by haveibeenpwned's creator, Troy hunt. https://twitter.com/troyhunt/status/1566565409939427328 https://twitter.com/troyhunt/status/1566565409939427328

dang 4y ago

Ok, we'll change to that from https://twitter.com/AggressiveCurl/status/1566161198248509440 https://twitter.com/AggressiveCurl/status/156616119824850944.... Thanks!

geuis 4y ago
Just spitballing, but this changing of source url reminds me of an idea I had a while back. In cases like this, where the url is changed from source, the old url should still be linked. Maybe as a sub title, or perhaps there should be a separate "changed" link on posts like this. The changed link could show title or url source changes.
- pvg 4y ago
  The old url is linked in the url-changed comment. Sometimes there's a pinned topcomment with the old url or the url of a merged thread, if the url change is likely to really confuse.
- mgdlbp 4y ago
  I'm curious if anyone's been keeping track of title and url changes. HN's small enough that one could easily hold the data. Someone has a page showing recent title changes,[1] but without retention. In that thread is a link to a browser extension that does the same, but I can't tell if its scraping is client-side (probably) or if there's a server. 1 https://news.ycombinator.com/item?id=21617016 https://news.ycombinator.com/item?id=21617016
- hackernewds 4y ago
  These kinds of edits, without edit history, seem ripe for abuse
  - boomboomsubban 4y ago
    How? And how would edit history realistically stop the admins who could modify the edit history?
    - pvg 4y ago
      One of the few times 'the blockchain' might be a sensible answer, silly as the premise of url or title attack is.
      - deleted 4y ago
        [deleted]
      - colejohnson66 4y ago
        True, but blockchains only help if you have multiple copies of the chain. With one copy, there’s nothing stoping the owner from rewriting history. It’s why companies saying they’re “investing in blockchains” means nothing; DB replication/redundancy doesn’t stop a malicious owner. So unless we’re all gonna start storing copies of HN’s database(s) on our home computers and phones, a blockchain won’t help stop abuse. Speaking of which, how big would said copies be?
  - phoe-krk 4y ago
    It all boils down to the fact that dang, the admin who does the edits, has a history of doing these changes quite rarely and within reason, plus he always leaves comments when he does so. That approach awarded him some general trust, including mine.
    - geuis 4y ago
      Part of the issue is that it isn't that rare. I guess because I'm reading HN all the time these changes seem fairly frequent, despite overall submission volume. I also have the same trust.
    - Chris2048 4y ago
      > plus he always leaves comments when he does so How do you know this?

NavinF 4y ago

> This is so far pretty inconclusive; some data matches production info, albeit publicly accessible info. Some data is junk, but it could be non-production or test data. It's a bit of a mixed bag so far. The screenshots suggest that someone scraped public data from TikTok and then got hacked. Highly doubt any of this came directly from TikTok.

hackernewds 4y ago

> Example: WeChat (Which is state owned)is within the same database as the TikTok DB (which claims not to give such information to their government). that seems very material, for the US population and Bytedance's verbal commitment to the govt. At this point, it's obvious that data of US citizens (a large chunk underage) has been heavily shared with what is perceived as a rival state

kweingar 4y ago
As others have pointed out, this seems to be from a 3rd party service that integrates WeChat with TikTok.
- deleted 4y ago
  [deleted]
- duskwuff 4y ago
  It might not necessarily even be a direct integration. WeChat is often used as a primary means of communication within China -- it's comparable to the status of email in the US.
deleted 4y ago
[deleted]
SZJX 4y ago
Literally “within the same database” is highly improbable as they are direct competitors just like Google and Microsoft are. On the other hand, countless companies will surely try to match user profiles across the apps, which sounds like a common practice everywhere.
- Diesel555 4y ago
  This is one of the major problems with understanding how China operates. We view China through a Western lens, and just assume we are right - which has very bad policy outcomes. If you read a lot about how the CCP operates (I specify the CCP to differentiate the CCP running the PRC since 1949 from the ROC who fled to Taiwan), it is highly probable that those companies share the same database and have common state ties. If you want data on this assertion research "capitalism with socialist characteristics." If you want the data straight from China read their 14th 5-year plan (I wish the US had these kinds of plans) translated by Georgetown University here [1]. China is very open about what they are doing in published writing. If you want more information read "The World According to China" by Liz Economy. I can suggest about 10 other books too, but that book was published in 2022 and is the most relevant book I read. Unfortunately China's government from a Western lens is such a complex topic I can't simply link to one article about how China runs its economy and "private" organizations to prove my point. This complexity unfortunately leads to people making false assumptions about how China operates without the requisite knowledge - and then deciding how we should make policy decisions towards China. [1] https://cset.georgetown.edu/publication/china-14th-five-year-plan/ https://cset.georgetown.edu/publication/china-14th-five-year...